keycloak_user_federation: add module argument that allows excluding bindCredential from update check
#8898
+23
−3
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
ansibullbot
added
WIP
russoz
reviewed
Sep 23, 2024
There was a problem hiding this comment.
Hi @fgruenbauer
Thank you for the contribution! Please add a changelog fragment.
Other than that, it does LGTM.
felixfontein
added
check-before-release
| - Set to V(true) to exclude O(config.bindCredential) when comparing the before state with the desired state to | ||
| determine wether an update is required. | ||
| type: bool | ||
| default: false |
There was a problem hiding this comment.
Hmm, how about using a string state with two states (choices) instead of a boolean? Then it is possible to later add more options, if for example the API is changed to allow other ways to handle this.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
SUMMARY
Keycloak redacts the value of the parameter
bindCredential(ldap admin password) in its responses, which makes diff and change detection difficult. The desired and the before/existing value can never really be equal unlessbindCredentialis set to**********or both are not set at all. This leads to the module always making an update if a value is set forbindCredential. The module might still returnchanged = false, because after an update the module compares before and after state. In check modechangedis alwaystruebut the diff empty, because the parameter is overwritten in the sanitize function.The added module argument would allow users to exclude the
bindCredentialparameter when comparing before and desired state. This would prevent unnecessary updates and check mode always havingchanged = true.ISSUE TYPE
COMPONENT NAME
keycloak_user_federation
ADDITIONAL INFORMATION
bindCredentialvalue